The Red Hat Satellite MCP server container image (satellite/foreman-mcp-server-rhel9) is provided as a Technology Preview to enable local deployment for advanced reporting and AI-driven data analysis. Two vulnerabilities, CVE-2026-9073 and CVE-2026-12112, are associated with this product, involving weaknesses categorized under CWE-532 (Information Exposure Through Log Files) and CWE-287 (Improper Authentication). The advisory does not provide patches or fixes and instead directs users to the Satellite documentation for MCP integration. No known exploits in the wild have been reported. The container image is available in the Red Hat container registry.

The vulnerabilities potentially expose sensitive information through improper logging (CWE-532) and may allow improper authentication (CWE-287), which could lead to unauthorized access or data exposure within the MCP server environment. However, no active exploitation has been reported, and the MCP server is currently a Technology Preview, which may limit widespread impact. The lack of an official fix means the vulnerabilities remain unmitigated at this time.

No official patches or fixes are currently available for these vulnerabilities. Users should follow Red Hat Satellite documentation for MCP integration and monitor Red Hat advisories for updates. Since this is a Technology Preview, consider limiting deployment to controlled environments until official fixes are released. Review and restrict access to the MCP server to mitigate potential risks from improper authentication and information exposure.